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The six-state protocol is a discrete-variable protocol for quantum key distribution, that permits 
to tolerate a noisier channel than the BB84 protocol. In this work we provide a lower bound on the 
maximum achievable key rate of a practical implementation of the entanglement-based version of the 
six-state protocol. Regarding the experimental set-up we consider that the source is untrusted and 
the photon-number statistics is measured using photon-number-resolving detectors. We provide the 
formula for the key rate for a finite initial number of resources. As an illustration of the considered 
formalism, we calculate the key rate for the setting where the source produces entangled photon 
pairs via parametric down-conversion and the losses in the channel depend on the distance. As a 
«j . result we find that the finite-key corrections for the considered scenario are not negligible and they 

' should be considered in any practical analysis. 

> 
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I. INTRODUCTION 

Quantum Key Distribution (QKD) was proposed for the first time in 1984 by Bennett and Brassard [4] (BB84 
protocol) and it is a method for permitting two parties, usually called Alice and Bob, to share a secret bit-string 
that might be used as a key for cryptographic applications. The most prominent application is encryption with the 
one-time pad[25], where Alice sums bitwise the message and the key for obtaining the cypher-text. The cypher-text 
is then sent to Bob, who recovers the original text by using the knowledge of the key. Note that the encrypted text is 
sent publicly on the channel and therefore it is readable by any eavesdropper who is tapping the channel. The security 
of this scheme relies on the fact, that from the eavesdropper's point of view the distribution of all possible cypher-texts 
O" 1 is uniform[24]. This last requirement implies that the key is chosen at random using a uniform distribution on the set 
of all possible keys. This is the point where QKD enters the game. In fact, using the laws of quantum mechanics, it is 
possible to create a bit-string with the guarantee that it is (almost) random from an eavesdropper's point of view [21]. 
In this paper we consider the entanglcmcnt-bascd version of the six-state protocol[3, 5, 7, 10]. It has been realized that, 
due to the use of a tomographic measurement, the six-state protocol is more robust against channel imperfections than 
0^ • the BB84 protocol. The six-state protocol was implemented experimentally, e.g. by Kwiat's group [13]. However, in 
the meantime the security analysis of this protocol has become more and more complete. In 2001, H.K. Lo[14] proved 
security of the protocol against the most general type of attacks and some years later R. Renner et al.[9, 12, 19] proved 
the security of the six-state protocol using information-theoretical arguments. Finite-key effects were considered for 
the first time by V. Scarani and R. Rcnner[22, 23] and by T. Meyer et al.[16]. It turns out that there is an initial regime 
where BB84 is advantageous over the six-state protocol and then there exists a second regime where the six-state 
protocol leads to higher secret key rates. The reason is the sifting procedure. More precisely, in the standard six-state 
protocol all measurement bases are chosen with the same probability and as a consequence, | of the measurement 
outcomes are discarded due to this sifting. In the standard BB84 protocol the fraction of discarded outcomes is \. 
j_j ■ However, in the year 2005, it was proven by H.K. Lo and M. Ardehali[15] that it is possible to choose one basis with 
high probability and the other two (one for the BB84) with a negligible probability without jeopardizing the security 
of the protocol. In the asymptotic case, using this biased scheme, the sifting ratio approaches one and therefore the 
six-state protocol permits to give a higher secret key rate. However, when finite-key corrections arc considered, for 
small block sizes it is not possible to choose with an arbitrary large bias the measurement basis and therefore the 
sifting advantage of the BB84 protocol leads to higher key rates. Note that recent papers considering the finite-key 
analysis studying the six-state protocol[l, 6, 22, 23] do not consider a realistic implementation with imperfections in 
the source, the channel and the detectors. The security proof becomes more involved due to the fact that a realistic 
source does have multi-photon pulses, which need special care. A common receipt is given by the squashing model[2], 
which permits to analyze the security of multi-photon sources using single photons and a special post-processing of 
the outcomes. However, it was proven that an active measurement set-up for the six-state protocol does not permit 
to use the squashing model [2]. A squashing model for the passive measurement set-up exists [2], but up to now only 
in the case of perfect detectors. However, another technique permitting to overcome the need of squashing model has 
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been developed by T. Moroder et al.[17]. The main observation is, that if we had perfect photon-number-resolution 
detectors (PNRD), then we would be able to avoid the problem of multi-photon pulses by post-selecting only single- 
photon pulses. In their paper the authors developed an experimentally feasible technique permitting to acquire the 
statistics of a PNRD. In this paper we want to extend their analysis considering finite-key corrections. In order 
to state clearly our result, we will consider an ideal set-up, where we perform a Quantum Non-Demolition (QND) 
measurement permitting to detect error-free the number of photons present in an incoming pulse. We will use a 
standard measurement set-up, which has detectors with finite efficiency. Note that, although the set-up we consider 
may be idealized, it permits to provide a lower bound for the performance of the six-state protocol in presence of a 
realistic scenario. Finally, we will consider a specific example, i.e. we will calculate the secret key rate in the finite 
case for a spontaneous parametric down-conversion of type-II (SPDC) source. 

The paper is organized as follows. In section II we describe the set-up followed by a presentation of the QKD 
protocol. In section III we present the security analysis and the formula for the secret key rate. In section IV we 
calculate the optimal secret key rate for a SPDC source. Finally, in section V we conclude this analysis. 



II. THE ENTANGLED VERSION OF THE SIX-STATE PROTOCOL 



In the first part of this section we present the set-up used by Alice and Bob. The second part considers an outline 
of the QKD protocol. 



A. Set-up (see Fig. 1) 
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FIG. 1. Set-up for QKD. The quantum channel is completely controlled by the eavesdropper. The classical channel is authen- 
ticated but otherwise tapped by the eavesdropper. The laboratories are by definition secure. 

• Source. An arbitrary source is placed in the middle of Alice and Bob. The source sends an n-photon pulse to 
Alice and an m- photon pulse to Bob. 

• Quantum Channel. We consider that the channel is lossy but otherwise error-free. We suppose that the 
signals are encoded in the source, such that they do not experience any decoherence in the channel. 

• Classical Channel. The classical channel is authenticated. 



• Alice's (Bob's) laboratory. We assume that the laboratories are trusted. Alice (Bob) performs a QND 
measurement for measuring the number of photons contained in the incoming pulse. The POVM of the QND 
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measurement is composed of two elements {|1) (1| , 1 — |1) (1|}, where {|n)} is the Fock-basis. After the QND 
measurement, the pulse passes a standard QKD-measurement set-up, where one measurement basis is chosen at 
random out of the X-, Y- and Z-direction. Note that regarding the detectors, we assume that they have finite 
efficiency t\d and negligible background noise. Moreover, we consider a misalignment [17, 21] in the detectors. 
Each time that a single photon arrives at the detection device, it is measured correctly with probability 1 — j]u . 



B. QKD protocol 

1. Entanglement generation and distribution. A source generates entangled pairs which are distributed 
through the quantum channel to Alice and Bob. 

2. Measurement. Alice and Bob choose at random and independently the measurement basis and to perform 
the measurement on the incoming pulse. We consider a biased choice of the bases, i.e., the basis Z is chosen 
with probability pz > \ and the other two bases are chosen with the same probability px = Py ■ The result 
of the measurements is recorded in a vector of the form (t A 7 b A ,b A ,p A ,basis A ), where bf = indicates that 
the detector for the classical value i on Alice side did not experience a click, otherwise bf = 1. The entry 
p A contains the result of the QND measurement, in particular p A = 1 when a 1-photon pulse is measured 
and p A = otherwise. The last entry contains a label for the measurement basis. The first entry t A is a tag 
permitting to distinguish the measurements, e.g., the time of occurrence of the measurement. 

3. Vacuum sifting. During this sifting we remove the non-measurement results. This step is performed locally 
and without communication between Alice and Bob. Let i=A,B. Whenp 1 = 1, it is still possible that b' l Q + b\ = 0, 
i.e., none of the detectors has clicked. This can happen due to the finite efficiency of the detectors. We can 
eliminate these events safely, incorporating the efficiency of the detectors in the efficiency of the channel. During 
this step Alice (Bob) calculate the value of b l Q + b\ and set p % = every time that b' l Q + b\ =0. 

4. Pulse sifting. We use the output of the QND measurement for conditioning the type of bits used for the 
key. Alice and Bob communicate via the classical channel the value of p A and p B for each measurement and 
discard all measurements with p A xp B ^ 1[17]. Note that this post -processing is possible only due to the fact, 
that the QND measurement is perfect and that we are considering entanglement-based QKD. If one of the two 
assumptions above is dropped, then security loopholes will arise [21]. 

5. Bases sifting. Alice and Bob exchange information regarding the measurement bases and discard the outcomes 
coming from different bases. 

6. Parameter estimation. Alice and Bob take a random sample from each basis and use this sample for 
estimating the Quantum Bit Error Rate (QBER) for each basis. We denote with ex, mx the fraction of erroneous 
bits in the sample of length rax- We choose [6] mx = my = riiz '■= Np x , where N is the number of bits after 
the pulse sifting. The QBERs along the Y and Z bases are defined analogously. Note that the worst-case QBER 
can be estimated with the fluctuations due to the finiteness of the sample. 

7. Error correction. During this step Alice and Bob apply a one-way error correction protocol and correct their 
strings. As result they will exchange leakec bits on the channel. 

8. Error verification. In realistic implementations it is possible that at the end of the error correction protocol, 
Alice and Bob do not have perfectly correlated bits. In order to acquire confidence regarding the remaining 
errors, they apply a two-universal hash function on their strings and they communicate the result of the function 
on the channel. This step costs log 2 (j|j;) bits. If the resulting hash tag is the same, then the two strings are 
the same with probability 1 — £ec ■ If the hashing produces a different outcome, Alice and Bob may perform 
more error correction followed by another error verification. 

9. Privacy amplification. Alice and Bob apply a two- universal hash function in order to shrink their string. 
The resulting string is called the key. 

In the next section wc will discuss a bound on the achievable key length £ as a function of a security parameter 
e. 
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III. FINITE SECRET KEY RATE 



The secret key rate is the relevant figure of merit for describing the performance of a QKD protocol. First of all, 
we are going to state the definition of security. 

Definition III.l. [18, 20] Let pke be the classical-quantum-state describing the classical key K of length £, distilled 
at the end of a QKD protocol, correlated with the quantum states of the eavesdropper p E . The state pke is said to 
be e-secure if 

™n\\\p KE - il® p E ,\\ x < e, (1) 

Pe' 2 l l 

where pe> is the quantum state of an eavesdropper not correlated with the key. 

The definition states that from the eavesdropper's (Eve) point of view the classical key K is indistinguishable from a 
random and uniform key with probability 1 — e. Note that the used definition of security is composable, i.e. if we have 
two protocols characterized by two different probabilities of failure, then, after a concatenation of these protocols, the 
probability of failure of the global protocol will be bounded by the sum of the single probabilities of failure. 

In the following we derive a formula for the £-secure key length t. We consider that Eve has complete control over 
the quantum channel and the source. Moreover, we consider the uncalibrated scenario[21], where the finite efficiency of 
the detectors are also attributed to Eve. Let p\\ be the probability that Alice and Bob receive a single photon. Then, 
starting with N sourcc initial pulses, the steps 1 — 4 of the QKD protocol (see Fig. 1) decrease the number of signals to 
^VsourccPn- Afterwards, the bases-sifting and the PE lead to A/s OUrce pii (p% — Px) resulting bits. For PE 3p x signals 
are used to estimate the QBER. The fluctuations due to finite statistics have been analyzed in [6, 8, 22, 23] . Note 
that differently to [6] we do not consider one symmetrized QBER. Instead we treat the QBER for each direction 
separately. 

Let ej. mi be the measured QBER in direction i = X,Y, Z, then with probability 1 — spe the real QBER e, is such 
that [6, 8, 22, 23] 

ej < e i>mi + 2C, (e PE , tth) (2) 

with 



In ( -±- ) + 2 In (m 

V spe i 



((spe, m) := ^ v ™' gm • (3) 

For the error correction protocol the total number of bits exchanged during the procedure is an upper bound on 
the information leaked to the eavesdropper about the final key For the simulations, we will use [8, 23] 

leak E c := hcnh(e), (4) 

where /ec > 1 depends on the used EC protocol, h(e) is the binary Shannon entropy, i.e., h(e) = — eloge — (1 — 
e) log (1 — e) and e is the QBER. This definition comes from the fact that nh(e) represents the asymptotic number of 
bits used by a perfect error correction protocol. The coefficient /ec represents a deviation of the real protocol from 
the asymptotic one. 

Regarding privacy amplification many bounds on the achievable secret key length are placed at the disposal in the 
literature]!, 6, 22, 23]. Note that the bounds given in [1, 6] are tighter than the bound given in [22, 23] . However, 
they require that the channel is symmetric. Although it is possible to transform any channel in a symmetric one, we 
consider the bound provided in [22, 23] to take the analysis simple and more general. 

The following result summarizes the preceding considerations and provides a formula for the achievable secret key 
length. It is important to emphasize, that the following theorem holds only due to our special set-up with the QND 
measurement and the particular post-processing, which selects only the pulses containing one photon. 

Theorem III. 2 ([22, 23]). Let N sourcc being the number of measurements performed by Alice and Bob. Let pn be 

the fraction of attempts resulting in a single-photon pulse entering Alice's and Bob's laboratories. The number of bits 
allocated for extracting a key is n := N somce pn(p 2 z — p x ). Lf Alice and Bob distill a key of length 



< _ max 

e ,epE,£PA,px ,pn 



n(S c (X\E) - hcKez)) - 21og 2 — - log 2 — 

spa £ec 



(5) 
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then it is e-secure, with < e + £ec + £ pa + £ pe < £ • T^e quantity Sq{X\E) is given by [21-23] 

S d X lE) ... 1 - + - ,1 - «,)» ( '-'^I/'^ 2 ) - < 6 > 

The entropy is calculated with the QBER inferred during the parameter estimation protocol (see Eq. (2)). 

We would like to point out that the theorem above is a standard theorem, the unique difference is that we are not 
using all signals for extracting the key but only the signals coming as single-photon pulse. 

The asymptotic formula for the secret key rate can be recovered as a special case of the theorem above for n — > oo 
and e — >• 0. 



IV. CASE STUDY: SPDC SOURCE 



In this section we will calculate the achievable secret key length for a pumped type-II down-conversion source [11] 
The produced state by this source can be written as 



oo 

I AB " 



■=^2VP^\^n) A B^ ( 7 ) 



n=0 

where 



and 



(n + l)g 

Pn -~ (1 + A)"+ 2 ' 1 ' 



\0n) AB ■= Y] , — — r 1" ~ m,m) A \m, n - m) B . (9) 
f— ' \Jn + 1 

m— 



The state above is written along one fixed direction, e.g. the Z-direction. The meaning of the notation \IhJv)a ^ s 
that on Alice side, a pulse with Ih + W photons is coming and Ih(W) have horizontal (vertical) polarization. 
The quantity 2A represents the mean photon pair number per pulse. 

In the following we calculate the quantities that enter the formula of the secret key rate (Eq. (5)). First of all, we 
express the probability that Alice and Bob receive only one photon. Then we calculate the QBER produced by the 
incoming pulse and finally, we find the optimal mean photon pair number per pulse, i.e. the one which maximize the 
secret key rate. 



A. Calculation of pn 



We denote with t/a the total transmittivity of Alice's set-up. It is given by r\A '■— 7 1dVc(L/2), where tjd is the 
efficiency of Alice's detectors and L is the distance between Alice and Bob. We consider a lossy, but otherwise perfect 
channel with attenuation coefficient a = 0.17 dB/km, such that the transmission probability of a photon is given by 
V c(L) :=10"^. 

Analogously we define the total efficiency on Bob's set-up, denoted by t\b- When an n-photon pulse is produced, 
during its travel on the channel and during the detection, some photons could be absorbed. The following formula 
gives the probability that an n-photon pulse becomes a 1-photon pulse, 

W n := Pn n 2 (l - iM) n-1 (l ~ VbT^VAVb- (10) 

The factor n 2 is a combinatorial factor coming from our ignorance which photon was absorbed. The total probability 
that both, Alice and Bob, receive one photon is given by 



oo 

Pll := W n . 



(11) 
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B. Calculation of the QBER 



In the six-state protocol measurements are performed along three orthogonal directions in the Bloch sphere, and, as 
explained above, three QBERs are involved. The Hamiltonian of the parametric down-conversion process is invariant 
under rotations from the X- to Y-, Y- to Z- and Z- to X-basis. Therefore, the state in Eq. (7) remains invariant in form 
under these transformations and hence the QBER is the same in all directions, i.e., there is only one QBER to consider, 
e.g., for the Z-direction. There are two contributions to the QBER. The first one comes from the misalignment and 
the second one is due to the fact, that the entering state is not maximally entangled. Let e n be the QBER generated 
by \4> n ) when misalignment is not considered. Then the total QBER is given by 

E^i( e Af(l - gn) + (1 - e M )e n )W n 

epDC ■= , (.12) 

Pu 

where eu := 2t]m(1 — ijm) and t\m is the misalignment-error probability. The first term of epDC accounts for the 
fact, that even if the incoming state did not produce a QBER, due to the misalignment there would be an error. The 
second contribution comes from the error generated by the incoming photons. Note that terms of the form eM^n 
are not considered, because the simultaneous appearance of these two errors will produce correlated outcomes. The 
quantity e„ can be calculated with the help of Eq. (9). This state is the superposition of n + 1 states. The first 
and the last term in the summation, with m = or m = n will produce a correlated outcome. On the contrary the 
remaining n — 1 elements in the summation will produce an error with probability ^ . Therefore we get 



1 — rr • ( 13 ) 



_ (n + l) - 2 _ 1 
Gn ~ 2(n+l) ~ 2 

From the formula above it is possible to verify that e% = 0, which is consistent with the fact that |0i) is a maximally 
entangled state. 

The common free parameter in the QBER epoc and in pu is the mean number of photons per pulse 2 A. 

Therefore, in the following we will calculate the optimal A permitting to maximize the secret key rate. 

As shown in Fig. 2, in order to have a low QBER epp,c it is necessary to have A small. For short distances, e.g. 
L = 20km it is possible to choose A < 20 and at the same time be able to extract a key. The reason is that the 
multi-photon pulses arrives to Alice and Bob without an appreciable degradation and therefore, we are able to filter 
those contribution to the QBER during the pulse sifting. However, the situation changes when the distance between 
Alice and Bob increases. We see that the mean number of photons per pulse has to be much smaller than 1 in order 
to decrease the multi-photon contribution to the QBER. From Fig. 2 we see that for L > 100km we have to choose 
A < 1 in order to have a QBER smaller than the maximal QBER tolerated by the six-state protocol. 



C. Asymptotic secret key rate 



The secret key rate in the asymptotic case characterizes the maximal achievable secret key rate in case of perfect 
error correction, no uncertainty in the estimation of the QBER and perfect security (e = 0). The formula is given by 



lim 



I 



>oo AT 
>0 iVs < 



max 

A 



Pu (1 - epDc) 1 



1 - 3e PDC /2 
1 — epDC 



h (e PDC 



(14) 



In Fig. 3 the secret key rate is shown as a function of the distance for two different experimental set-ups. A 
comparison between an idealized scenario (rjp, = 1,t)m = 0) and a more realistic one (r/p> = 0.1, tjm = 0.03) shows 
that the secret key rate decreases of at least 2 orders of magnitude. Regarding the optimal mean of photon-number 
per pulse, as shown in Fig. 4, the difference is of the order of 1. The optimized function is non- linear and the used 
optimization algorithm may only permit to find a local optimum. 

Finally, we would like to point out, that a similar analysis of the asymptotic case was performed by Moroder et 
al.[17] with a source placed in an asymmetric position, i.e., closer to Bob than to Alice. 
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FIG. 2. (Color online) Value of epDC (Eq. (12)) as a function of the probability that both, Alice and Bob, receive one photon 
as a function of the mean number of photons produced by the source for various distances. The horizontal line represents the 
maximal QBER tolerated by the six-state protocol. The absorption of the channel is a = 0.17 dB/km and Alice and Bob use 
perfect detectors t)d = 1, r\M = 0. 



D. Finite-key analysis 

In a practical execution of a QKD protocol, the initial number of resources is always finite, therefore we need to 
take into account corrections to the asymptotic secret key rate. The formula for the secret key rate is 

Pn(p% ~ P%) ((1 - e PDC ) (l - h (I^^Z?) ) - frch(e z )\ (15) 



1 2 (2 

-21og 2 log 2 5Wlog 2 - 

£pa £ec V \ £ 



(16) 



The calculations are done in such a way, that we optimize over all free parameters: the mean number of photons 
per pulse (A), the probability to measure along the Z basis (pz), the failure probability for the parameter estimation 
(epe), for privacy amplification (spa) and the smoothing parameter (e). 

For extracting a key it is necessary to have a block bigger than a specific length. As shown in Fig. 5, even for short 
distances the source has to emit at least 10 5 pulses with in mean A ~ 0.1 photons per pulse for extracting a key of 1 
bit. However, if we consider detector inefficiencies and misalignment errors, the requirements will become much more 
stringent. In particular, we need at least 10 9 pulses for extracting a key. 

The second quantity we want to analyze is the secret key rate (Eq. (5)). As shown in Fig. 6, for a perfect set-up 
(j]d = 1, f]M — 0) the finite secret key rate differs significantly from the asymptotic secret key rate. In particular, for 
all distances considered in Fig. 6, the secret key rate differs of at least 10% (N sourcc = 10 10 , L = 20 km) from the 
asymptotic key rate. However, for more realistic initial number of pulses, the difference is bigger, e.g for L = 100 km 
and N SOUICC = 10 8 , the difference between the asymptotic secret key rate and the one with finite-key corrections is of 
one order of magnitude. In case of imperfections we will have similar plots but with a worse secret key rate. However, 
the qualitative behavior of the plot remains similar to Fig. 6. 
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V. CONCLUSION 



In this paper we did a step towards the analysis of a realistic implementation of the entanglement-based version 
of the six-state protocol. We considered that the standard QKD measurement is preceded by a QND measurement 
permitting to know the number of photons entering in the source. This special set-up with a post-processing which 
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FIG. 5. (Color online) Minimal number of initial pulses permitting to extract a key of 1 bit as a function of the length L 
for a perfect set-up (i]d = 1, tjm = 0). The absorption of the channel is a = 0.17 dB/km. Security parameter e = 10 -9 , 
£ec = 1CT 10 , f EC = 1.2. 



considers only signals coming from a single-photon source permits to evaluate secret key rates for the six-state protocol. 
We studied the case of an arbitrary large number of initial pulses as well as of a finite key. As result we found that 
in realistic implementations with finite-efficiency detectors and misalignment, the minimal number of pulses for being 
able to extract a key is around 10 9 pulses at the distance of a few kilometers. Note that this is a very stringent 
requirement. In fact, considering an ordinary source, which emits pulses at the rate of 10 MHz, at the distance of 20 
km between Alice and Bob, the time needed for extracting a key of 1 bit will be of the order of 100 seconds. Using 
the asymptotic key formula, in the same time, it could be possible to obtain a key of length 10 6 bits, which would be 
unfortunately completely insecure. Therefore, we emphasize once again that finite-key corrections are necessary for a 
realistic and correct security analysis. 

Regarding future work, we underline that more realistic experimental imperfections should be taken into account in 
order to characterize the performance of the six-state protocol. In a future work, we want to consider the encoding of 
the quantum bits on the quantum channel and to study the effects of decoherence. This is a problematic issue which 
limits practical implementations of the six-state protocol and needs a careful analysis. 
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FIG. 6. (Color online) Secret key rate as a function of the number of pulses emitted by the source (iVsource) for a perfect set-up 
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